The TCP protocol is vulnerable to SYN flood type attacks and one of the effective defense methods is the Bloom filter. Bloom filters are efficient data structures that serve to store large amounts of data in a small storage space and allow for quick checks if the data is contained in the filter. The time required to verify the affiliation of a Bloom filter is independent of the amount of data contained in the Bloom filter. In this paper, we analyze the Bloom filter behavior when processing TCP traffic with the purpose of checking the SYN-ACK / ACK (SYN) pairs of packets. In the generated traffic examples, the percentage of false positive recognized packages for three different counting Bloom filter code implementations was tested. The paper analyzes Bloom filter efficiency dependence on the number of applied hash functions and the size of the internal field.